feat(api): add admin reservation cancel endpoint

Add DELETE /api/admin/bookings/reserve to release admin walk-in/call-in reservations.

New handler AdminCancelReservationHandler targets only RESERVATION:admin:%
entries (partitioned from user RESERVATION:user:% by WHERE clause). Includes
12 tests covering walkin + callin success, isolation, no-op, unauth, empty ctx,
walkin+callin coexistence, anon untouched, response format parity, overlapping
reservations deleted, user reservations untouched, and idempotent double-cancel.

Inverse-isolation tests in cancel_reservation_test.go prove the user-side
DELETE /api/bookings/reserve does not touch admin or anon reservations.

backend/main.go

@@ -357,6 +357,7 @@ func main() {
 				r.Post("/{id}/confirm", bookings.ConfirmBookingHandler)
 				r.Post("/{id}/cancel", bookings.AdminCancelBookingHandler)
 				r.Post("/reserve", bookings.AdminReserveSlotHandler)
+				r.Delete("/reserve", bookings.AdminCancelReservationHandler)
 				// Edit request endpoints
 				r.Get("/edit-requests", bookings.AdminListAllEditRequestsHandler)
 				r.Get("/{id}/edit-request", bookings.AdminGetBookingEditRequestHandler)